cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 116

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2023-30852EPSS 1.0%

    Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CS…

  2. 6.5CVE-2023-2336EPSS 0.7%

    Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.

  3. 8.8CVE-2023-24836EPSS 1.2%

    SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to per…

  4. 4.9CVE-2023-22901EPSS 0.9%

    ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary system files.

  5. 7.8CVE-2023-26243EPSS 0.3%

    An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and ini…

  6. 6.5CVE-2023-30265EPSS 1.0%

    CLTPHP <=6.0 is vulnerable to Directory Traversal.

  7. 7.5CVE-2023-2273EPSS 0.7%

    Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Pat…

  8. 2.2CVE-2023-25815EPSS 0.8%

    In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-p…

  9. 7.5CVE-2023-25652EPSS 52%

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can…

  10. 6.5CVE-2023-29200EPSS 0.8%

    Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the…

  11. 6.5CVE-2023-23838EPSS 1.3%

    Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.

  12. 9.8CVE-2023-27105EPSS 1.3%

    A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modif…

  13. 8.1CVE-2023-30626EPSS 2.0%

    Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cros…

  14. 7.2CVE-2023-22914EPSS 1.0%

    A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with …

  15. 7.5CVE-2022-48476EPSS 0.8%

    In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

  16. 7.5CVE-2023-31059ExploitEPSS 5.6%

    Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.

  17. 7.8CVE-2023-25508EPSS 0.2%

    NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalati…

  18. 7.5CVE-2023-30620EPSS 1.0%

    mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the…

  19. 7.5CVE-2023-26101EPSS 0.7%

    In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability to retrieve files on the Flowmon appliance's local filesystem.

  20. 6.5CVE-2023-28459ExploitEPSS 6.7%

    pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.

  21. 4.3CVE-2023-28458ExploitEPSS 3.5%

    pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.

  22. 7.8CVE-2023-21093EPSS 0.1%

    In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a path traversal error. This could lead to local escalation of privilege with no additional execution p…

  23. 7.5CVE-2023-29887ExploitEPSS 4.7%

    A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.

  24. 4.3CVE-2023-30548EPSS 0.9%

    gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed…

  25. 6.5CVE-2023-29004EPSS 0.9%

    hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can …

  26. 8.8CVE-2023-1109EPSS 0.8%

    In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality o…

  27. 7.5CVE-2022-34127ExploitEPSS 6.8%

    The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.

  28. 7.5CVE-2022-34126EPSS 1.2%

    The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.

  29. 7.5CVE-2022-47501ExploitEPSS 10%

    Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

  30. 5.3CVE-2023-26559EPSS 1.0%

    A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XM…

  31. 9.8CVE-2023-27648EPSS 2.6%

    Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage.

  32. 9.8CVE-2022-47027EPSS 1.5%

    Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.

  33. 7.5CVE-2023-26969EPSS 1.1%

    Atropim 1.5.26 is vulnerable to Directory Traversal.

  34. 9.1CVE-2023-27812EPSS 1.2%

    bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.

  35. 7.8CVE-2022-42470EPSS 0.3%

    A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specifi…

  36. 7.3CVE-2023-26293EPSS 0.2%

    A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Por…

  37. 6.5CVE-2023-29186EPSS 23%

    In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (ad…

  38. 9.8CVE-2023-1478EPSS 1.1%

    The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.

  39. 4.9CVE-2023-0156EPSS 20%

    The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the…

  40. 9.8CVE-2023-27603EPSS 1.8%

    In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to v…

  41. 8.8CVE-2023-1956EPSS 1.1%

    A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_img of the component Image Handler…

  42. 9.8CVE-2023-29478EPSS 1.7%

    BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution.

  43. 7.5CVE-2023-26820EPSS 0.8%

    siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.

  44. 7.5CVE-2020-19678EPSS 3.5%

    Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php.

  45. 6.5CVE-2023-20129EPSS 0.9%

    Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site script…

  46. 9.8CVE-2020-19279EPSS 1.1%

    Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.

  47. 7.1CVE-2023-25305EPSS 0.6%

    PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.

  48. 7.1CVE-2023-25303EPSS 0.6%

    ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.

  49. 6.5CVE-2022-43771EPSS 24%

    Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources th…

  50. 8.8CVE-2023-27534EPSS 2.4%

    A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicat…